owaspCheckSecurity
owaspCheckSecurity checks whether the selected operations declare security or inherit it from the root.
An operation’s security replaces the root requirement. Empty arrays remove inherited authentication. When nullable is false, empty requirements ({}) are also reported, including anonymous alternatives beside authenticated requirements.
How do I use this function?
This function is configured by the following functionOptions.
| NAME | TYPE | REQUIRED? | DESCRIPTION |
|---|---|---|---|
| nullable | boolean |
no | Allow anonymous requirements ({}); defaults to false |
| methods | []string |
yes | HTTP methods to check, in lowercase |
Example ruleset configuration
my-security-rule:
description: API should be protected by a `security` rule either at global or operation level.
type: validation
given: $
then:
function: owaspCheckSecurity
functionOptions:
nullable: false
methods:
- post
- put
- delete
- patch
Used by the following rules: